We use cookies to customise content for your subscription and for analytics.If you continue to browse Lexology, we will assume that you are happy to receive all our cookies. For further information please read our Cookie Policy.

Electronic data security after Riley v. California

It’s 10 p.m. Do you know where your company’s data is? One of your administrative employees’ cell phone may be sitting on his nightstand. Another phone accompanies a vice president of operations to her favorite late-night diner. A third is with an R&D employee at a sporting event, and a fourth is speeding down the highway in the CFO’s car.

Mobile technology carries both benefits and risks to businesses and individuals alike. Although the ability to access almost any personal and business data from nearly any location has obvious advantages, maintaining control over that highly portable data can be a challenge. The need for policies and procedures to protect that portable information from falling into the hands of third parties—including, for example, criminals bent on identity theft—is well documented. But individuals and companies also should be concerned about their private data inadvertently (or prematurely) being turned over to the police or other government agents. What happens, for example, when one of your employees, carrying that portable data, is arrested for a crime (related or unrelated to your company’s business)? Can the police search through the cell phone containing the individual’s and/or company’s private data in connection with a search incident to the employee’s arrest?

The Supreme Court weighed in on this topic in its June decision in Riley v. California and, in doing so, alleviated at least some of these concerns. In Riley, the police searched the defendants’ cell phones incident to an arrest without first obtaining a warrant, and discovered information that led to additional serious charges against the defendants. But a unanimous Court concluded that those convictions should be reversed and declared that, in most circumstances, the government must obtain a warrant before searching an individual’s cell phone.

For a number of reasons, as explained below, the Riley decision is relevant to any company concerned about controlling its sensitive information.

Background: A Tale of Two Cell Phones

The Supreme Court’s decision involved two similar but unrelated cases that were consolidated on appeal: Riley v. California, and United States v. Wurie. These cases both presented the same constitutional question: May the police, without a warrant, search digital information on a cell phone seized from an individual who has been arrested?

Riley v. California

In the first case, an officer stopped David Riley for driving with expired registration tags. After learning that Riley’s license had been suspended, the officer impounded Riley’s car and, in doing so, the police discovered two loaded handguns concealed in the car—a violation of California law. The police arrested Riley for this violation and seized a “smart phone” from Riley’s pants pocket. Rather than simply impounding the phone and attempting to obtain a warrant, the arresting officer accessed Riley’s phone and discovered words that he believed to be gang-related slang.

Shortly thereafter, a police detective also “went through” Riley’s phone “looking for evidence, because . . . gang members will often video themselves with guns or take pictures of themselves with guns.” Indeed, the detective discovered incriminating videos and photographs on the phone, which connected Riley with a car that the police suspected had been involved in a recent shooting.

The state charged Riley with firing at an occupied vehicle, assault with a semiautomatic firearm, and attempted murder, all in connection with that earlier shooting. Riley asked the trial court to suppress the evidence obtained from his cell phone, but the court rejected that request. Riley was convicted and sentenced to 15 years to life in prison. The California Court of Appeal affirmed the convictions, and the California Supreme Court denied Riley’s petition for review.

United States v. Wurie

In the second case, an officer performing routine surveillance observed Brima Wurie conduct an apparent drug sale from a car. After arresting Wurie, the police seized a “flip phone” from Wurie. The police noticed that Wurie’s phone was repeatedly receiving calls from a source identified as “my house” on the phone’s external screen. By accessing the contents of the phone, the police used that incoming phone number and photographs stored in the phone to locate an apartment. The police obtained and executed a search warrant for the apartment, where they discovered crack cocaine, drug paraphernalia, a firearm and ammunition, and cash.

Wurie was charged with distributing crack cocaine, possessing crack cocaine with intent to distribute, and being a felon in possession of a firearm and ammunition. Wurie asked the trial court to suppress evidence obtained as a result of the officers’ warrantless search of his phone, including the evidence obtained from the apartment. The court denied that request and Wurie was convicted and sentenced to 262 months in prison. On appeal, the First Circuit reversed the denial of Wurie’s motion to suppress and vacated Wurie’s convictions.

The Supreme Court’s Decision

The Supreme Court agreed to review both cases in order to decide how the doctrine of search incident to arrest applies to cell phones. In a unanimous decision authored by Chief Justice Roberts, the Court concluded that, in most circumstances, the government must obtain a warrant before searching an individual’s cell phone. Thus, the Court reversed the judgment of the California Court of Appeal and remanded the case for further proceedings, and affirmed the First Circuit’s judgment. Justice Alito filed a concurring opinion to voice concerns with the Court’s reasoning, but joined in the Court’s judgment.

The Court began by surveying the precedent governing an often-used exception to the warrant requirement for searches incident to an arrest. While concerns for officer safety and preservation of evidence are principles that underlie the exception, the Court’s prior decisions have recognized a broader categorical rule. Thus, an officer is entitled to inspect any personal property found in the course of a lawful search of an arrestee’s person because harm to officers and destruction of evidence are risks present in all custodial arrests.

The Riley Court acknowledged that “Robinson’s categorical rule strikes the appropriate balance in the context of physical objects,” but concluded that “neither of its rationales has much force with respect to digital content on cell phones.” The Court provided several reasons supporting this conclusion.

First, the Court reasoned that no comparable risk to officer safety exists when the search is of digital data. “Digital data stored on a cell phone cannot itself be used as a weapon to harm an arresting officer or to effectuate the arrestee’s escape,” the Court explained. The Court rejected the government’s assertion that the search might somehow protect officers, such as by alerting officers that confederates of the arrestee are approaching. To the extent such threats exist, the Court suggested that other case-specific exceptions to the warrant requirement could be considered, such as exigent circumstances.

Second, with respect to the preservation of evidence, the Court reasoned that once officers have secured a cell phone, there is no longer any risk that the arrestee himself can delete incriminating data. The government argued that there remained a risk that the data could be remotely wiped, or the phone could become encrypted when the phone locks. The Court remained unconvinced. Remote wiping and a phone’s security features operate independently of the arrestee, the Court noted. Moreover, neither poses a prevalent problem, and law enforcement has alternative solutions to those problems when they arise.

Third, the Robinson decision relied in part on the fact that when someone is arrested, his or her privacy interests diminish significantly, a physical search being no more intrusive than the arrest itself. But the Court observed that, when the privacy concerns are weighty enough, a search might require a warrant notwithstanding the arrestee’s diminished expectations of privacy. Cell phones differ both quantitatively and qualitatively from other objects that an arrestee might carry, the Court explained.

Quantitatively, the storage capacity of current cell phones permits individuals to carry with them far more information than would be carried by someone in physical form. “Most people cannot lug around every piece of mail they have received for the past several months, every picture they have taken, or every book or article they have read,” the Court observed. And the use of cloud computing further exaggerates the quantitative nature of cell phone data.

Qualitatively, a cell phone contains Internet search history, tracks where a person has been, records transactions, and stores various other data so private that it likely could not even be found if the police ransacked the person’s home. Together, this information “can form a revealing montage of the user’s life,” the Court explained.

In the course of holding categorically that a warrant is required to search a cell phone incident to an arrest, the Court rejected a series of alternative standards proposed by the government, such as restricting the scope of a warrantless cell phone search to those areas of the phone where an officer reasonably believes she will find relevant information. The Court concluded that this and other proposals would be either unworkable or incompatible with the Court’s precedent. Instead, the Court noted that other case-specific exceptions—such as exigent circumstances—might justify a warrantless cell phone search in certain circumstances.

Justice Alito offered a brief concurrence. In his view, officer safety and the preservation of evidence are not the only reasons for allowing a warrantless search incident to an arrest. Moreover, Justice Alito pointed to anomalies created by the Court’s approach, such as the same evidence being treated differently if carried in digital rather than physical form. Nonetheless, he joined in the Court’s holding because he could not see a workable alternative— with the caveat that he would reconsider the question if Congress or state legislatures were to enact legislation addressing the issue in another manner.

Riley’s Relevance to Corporate America

The factual circumstances underlying the arrests, charges, and convictions at issue in Riley seem a world away from the issues affecting the corporate world. However, for a number of reasons, the Riley decision may prove particularly relevant in the context of government enforcement and corporate investigations.

Many company employees carry mobile devices that contain company emails, calendar information, contact lists, and other potentially sensitive data. The possibility that one of those employees may be arrested—for a DWI, a domestic dispute, or any number of possible reasons—is largely outside of the company’s control. A cell phone search incident to that arrest might, for example, disclose sensitive information regarding an internal investigation underway. Such an uncontrolled disclosure could compromise the investigation, deprive the company of the ability to resolve the issue internally, and draw unnecessary government attention to what may ultimately prove to be a non-issue.

Worse yet, the employee’s cell phone might contain information regarding misconduct of which the company was not yet aware. Unwittingly, the arrested individual and the company could become the targets of a government investigation. In the same way that David Riley’s expired vehicle registration tags quickly led to his conviction for attempted murder, a simple disorderly conduct arrest could escalate to something much greater, and drag the company along with it.

After Riley, these risks appear to have diminished, at least to an extent. To be clear, the Fourth Amendment protections against warrantless searches and seizures protect only the arrestee and not necessarily any third party. In other words, if the police search a cell phone without a warrant and find information incriminating a third party (e.g., the company for which the arrestee works), only the arrestee’s Fourth Amendment rights have been violated, and the third party would have no basis to object to the warrantless search and seizure. Thus, while evidence obtained from a warrantless search of the CFO’s cell phone may not be admissible against the CFO, it could be admissible against the company or any other company officer or employee.

Nonetheless, the Riley decision does provide at least some indirect protection for third parties for several reasons. For example, Riley may decrease the likelihood that a cell phone will be searched in the first place because of the need to obtain a warrant. Riley may make police think twice about whether the phone really is relevant to the crime for which the person has been arrested. Moreover, even if police obtain a search warrant, the warrant may limit the scope of that search. The warrant may not allow the police to search every nook and cranny of the cell phone’s memory and “cloud” storage. In so doing, the warrant may potentially exclude third-party information irrelevant to the crime for which the person was arrested.

To be sure, the Court’s discussion of privacy interests focused on personal information. But the lines between personal and business information have become increasingly blurred, as individuals use the same device for multiple purposes. Indeed, the Riley Court established a categorical rule for all cell phone data in large part because law enforcement cannot be expected to know in advance what information might be found in what part of a phone. And Justice Alito joined the Court’s holding despite his reservations about treating all cell phone data the same, because he could not see a workable alternative.

Conclusion

The Riley decision has wide significance given the increasing ubiquity of smart phone usage. As Chief Justice Roberts wrote in his majority opinion, “the proverbial visitor from Mars might conclude that [cell phones] were an important feature of human anatomy.” The cell phone—and particularly the smart phone—has also become part of the anatomy of a company. Thus, the Riley decision is a good step forward for individuals and businesses alike.